[BUG] appDataUpdate bypasses authorization for partial special keys updates

[MRawhani]

Describe the Bug

AppSocket.updateData() immediately updates records containing id and one of these fields:

deleted, closed, public, end, disable, enabled.

This early return bypasses the authorization logic that follows it. A user may therefore update a record they do not own by submitting its ID with one of these fields.

Reproducibilty

• Yes
• No
• Sometimes

Steps to Reproduce the Behavior

1. Sign in as a non-admin user.
2. Obtain the ID of a record owned by another user.
3. Emit appDataUpdate with that ID and a special field, for example:

{
  "table": "document",
  "data": {
    "id": 123,
    "deleted": true
  }
}

4. Observe that updateById() is called before the ownership check.

Expected Behavior

Every update is authorized before changing the record. Partial updates remain supported, and required-field validation does not incorrectly reject them.

Models beforeUpdate hooks can be a possible way to handle this, which may contain conditional runs for those special keys updates only.

Actual Behavior

Updates containing one of the special fields return early and bypass the authorization check.

Screenshots

Not applicable.

Additional Information

Relevant file: backend/webserver/sockets/app.js, AppSocket.updateData().

Acceptance criteria:

• No update path bypasses authorization.
• Partial updates such as delete, publish, close, disable, and enable continue to work.
• Required fields are enforced when creating records without requiring complete payloads for partial updates.
• Model-specific authorization is enforced before mutation.